---
id: "CVE-2026-116200"
kind: "vulnerability"
aliases: ["CVE-2026-116200"]
title: "Snipe-IT: LDAP StartTLS failure silently falls back to cleartext binds"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["active-directory", "ldap", "package", "self-hosted", "snipe-it"]
not_affected_if: ["ldap-disabled", "ldaps-only", "managed-hosting"]
published_at: "2026-10-25T14:17:00+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:42:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116200", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# Snipe-IT: LDAP StartTLS failure silently falls back to cleartext binds

Snipe-IT before 8.6.3 ignores the return value of ldap_start_tls() when connecting to LDAP, so a failed TLS upgrade still sends the bind in cleartext. An on-path attacker can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Snipe-IT version in `config/version.php` or the admin footer; affected if below `8.6.3`.
- Check whether LDAP login is enabled and whether the LDAP server URL uses `ldap://` with StartTLS enabled in the LDAP settings.

## Fix

- Upgrade Snipe-IT to `8.6.3` or later.
- Until upgraded, use `ldaps://` (LDAP over TLS on port 636) so no StartTLS negotiation happens, and rotate the LDAP service-account password.

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116200

## From the sources

Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_